Barrier ownership and assurance: from assigned names to verified capability

Assign ownership at a useful level

The CAA control-ownership guidance links accountability to managing and resourcing a control, rather than automatically assigning every item to the most senior person. Applied as a general modelling principle, a barrier owner needs a clear functional scope. A role that cannot obtain relevant evidence or initiate the necessary action may be only a label.

For a generic shipboard protective function, ownership might need coordination across machinery operation, electrical support, instrumentation and shore-based resources. This article does not prescribe which rank or office must hold that role. The actual arrangement must fit the company’s responsibilities, shipboard authority and applicable requirements. A bow-tie allocation should clarify those arrangements, not silently replace them.

Separate the work, the decision and the challenge

The person who carries out a test, the person who interprets a technical shortfall and the person who decides how the operation responds may perform different roles. An assurance reviewer can then examine whether the evidence supports the claim. One person may hold more than one role where appropriate, but the distinctions in the work should remain visible.

Without that separation, a completed work order can be treated as both proof of performance and authorization to return to service, even when the result recorded a limitation. The record should identify who assessed the result, which criterion was used and who had authority for the resulting decision. A signature has meaning only in relation to that defined responsibility and evidence.

Connect ownership to the existing maritime framework

IMO’s ISM Code overview emphasizes safe ship management, risk assessment and appropriate safeguards within varied company and ship conditions. Barrier ownership can support such a management framework by making a particular protective function and its evidence traceable. It does not create a new statutory appointment or establish compliance merely because every diagram box has a named role.

The owner should know the applicable escalation route when a function is impaired or its evidence is missing. That route needs to reach the people who control the affected operation and resources. Reporting the issue to an inbox with no timely response mechanism does not restore capability. The response must remain consistent with the actual shipboard and shore-based authority structure.

Build an evidence chain around the requirement

HSE’s maintenance, inspection and testing guidance connects responsibilities, competence, records and clear pass/fail criteria. For an illustrative barrier, start with the required function, identify the hardware and human actions needed, and link each material requirement to the evidence that addresses it. The chain should distinguish design evidence, current condition and demonstrated response.

A certificate can identify a component’s tested scope; a maintenance record can show work performed; an end-to-end test can demonstrate a response in one configuration. None should be described as proving more than it actually establishes. The barrier owner’s task is to understand the combined argument and gaps, including whether a necessary support or interface falls outside the available evidence.

Do not equate evidence coverage with reliability

Suppose an invented assurance register lists 20 requirements and contains current evidence for 18. Its document-coverage fraction is 18/20 = 90%. That is not 90% reliability, a 10% failure probability or permission to ignore the two missing items. One missing item might concern the only power source or the barrier’s ability to survive the initiating hazard.

The requirements also need not carry equal significance. Adding many easily evidenced minor requirements can improve the percentage without addressing the unresolved critical function. Preserve the identity and consequence of each gap. A coverage summary is useful for finding incomplete work, while the technical judgement about capability must examine what remains unproven and why it matters to the scenario.

Manage interfaces and handovers explicitly

Barrier capability often crosses organizational boundaries. A contractor can service a device while the ship controls its connections and operating configuration. Shore staff can approve a replacement while onboard personnel observe a changed response. The assurance process needs a clear path for those observations to reach the person able to reconcile the requirement and evidence.

A handover should convey the current configuration, impairments, temporary arrangements, unresolved findings and the next decision or test needed. Passing only the name of the new owner loses the state of the barrier. Ownership should remain traceable during absence, crew change and organizational change, including who can act while the usual role holder is unavailable.

Challenge favourable evidence as well as adverse evidence

HSE’s leadership monitoring guidance includes preventive information, incident evidence and audits of control effectiveness. A useful assurance challenge asks whether a passing result used the correct criterion, covered the relevant path and represents the present configuration. The challenge need not wait until the barrier fails on an actual demand.

For example, a test may have bypassed an interface to protect equipment during the test. That can be reasonable for its limited purpose, but the result cannot silently demonstrate the bypassed interface. An assurance review should preserve that boundary and identify what other evidence covers it. The aim is to test the argument, not merely confirm that a file exists and bears the expected signatures.

Follow shortcomings through to restoration

A finding should identify the affected requirement, observed condition, scenario implication, responsible action and evidence needed for closure. A replacement part arriving is progress; installation and demonstrated function are separate steps. Closing a procurement task should not automatically close the associated barrier impairment.

If the planned action cannot yet be completed, the unresolved state and its technical implications should remain visible through the applicable decision process. Repeatedly extending a due date does not generate additional capability. Where temporary arrangements are evaluated, their scope, duration and dependencies need their own evidence, together with an explicit route back to the intended configuration.

Keep accountability connected to learning

An effective owner can explain what the barrier is intended to do, what evidence currently supports it, where uncertainty remains and what happens when the evidence changes. Recurring defects should feed back into maintenance strategy, design assumptions and the barrier model rather than appear as unrelated closed jobs. One shared weakness may affect several functions and several organizational owners.

Ownership and assurance are therefore continuing connections between decisions and working capability. The arrangement should make technical concerns easier to communicate and resolve, without creating a paperwork substitute for the function itself. The result sought is a defensible, current account of the barrier’s capability and limits, supported by people who can act on that account.

Sources

• Assigning control ownership · UK CAA · Source check date: 2026-10-07
• The International Safety Management Code · IMO · Source check date: 2026-10-07
• Maintenance, Inspection and Testing: Overview · UK HSE · Source check date: 2026-10-07
• The Plan, Do, Check, Act approach: Check · UK HSE · Source check date: 2026-10-07